HPAA – Provide ongoing contract maintenance with your BA

Your work isn’t done after signing a contract with a business associate (BA). You need to do more than simply assume that your BA is following through on terms of the contract.

Although the BA is performing important continuing functions, says John R. Christiansen, JD, managing director at Christiansen IT Law in Seattle, covered entities should provide regular (e.g., annual) audits for security compliance. Consider checking for some aspects of privacy compliance as well.

“The BA may want to conduct its own audits and provide the reports to clients in order to avoid audit duplication, which is fine, as long as the auditor is genuinely independent and competent and the report is complete,” says Christiansen.

William H. Roach Jr., MS, JD, partner at McDermott Will & Emery in Chicago, says periodic inquiry is sufficient unless you are suspicious that the BA is violating the agreement.

“In that case, the covered entity is required to take corrective action up to and including terminating the BA agreement if the BA does not take the necessary corrective action,” he says.

Reproduced from HIPAA Weekly © 2008 HCPro, Inc., 200 Hoods Lane, Marblehead, MA 01945. 781/639-1872. www.hcpro.com. Used with permission.

About the Author

Reed Tinsley CPA

This article is written by Reed Tinsley, a Houston, TX-based CPA with over 30 years of experience advising physicians and medical practices across Texas and the United States. Reed holds certifications as a Certified Valuation Analyst (CVA), Certified Healthcare Business Consultant (CHBC), and Certified Financial Planner (CFP), specializing exclusively in the healthcare sector. He is a published author, nationally recognized speaker, and trusted advisor to physicians on accounting & tax, practice management, and financial planning. Schedule a Free Consultation.